agent-claw: automated task changes

cdk/node_modules/aws-cdk-lib/aws-backup/lib/backupable-resources-collector.d.ts

@@ -0,0 +1,6 @@
+import type { IConstruct } from 'constructs';
+import type { IAspect } from '../../core';
+export declare class BackupableResourcesCollector implements IAspect {
+    readonly resources: string[];
+    visit(node: IConstruct): void;
+}

cdk/node_modules/aws-cdk-lib/aws-backup/lib/backupable-resources-collector.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.BackupableResourcesCollector=void 0;var dynamodb=()=>{var tmp=require("../../aws-dynamodb");return dynamodb=()=>tmp,tmp},ec2=()=>{var tmp=require("../../aws-ec2");return ec2=()=>tmp,tmp},efs=()=>{var tmp=require("../../aws-efs");return efs=()=>tmp,tmp},rds=()=>{var tmp=require("../../aws-rds");return rds=()=>tmp,tmp},core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp};class BackupableResourcesCollector{resources=[];visit(node){node instanceof efs().CfnFileSystem&&this.resources.push(core_1().Stack.of(node).formatArn({service:"elasticfilesystem",resource:"file-system",resourceName:node.ref})),node instanceof dynamodb().CfnTable&&this.resources.push(core_1().Stack.of(node).formatArn({service:"dynamodb",resource:"table",resourceName:node.ref})),node instanceof ec2().CfnInstance&&this.resources.push(core_1().Stack.of(node).formatArn({service:"ec2",resource:"instance",resourceName:node.ref})),node instanceof ec2().CfnVolume&&this.resources.push(core_1().Stack.of(node).formatArn({service:"ec2",resource:"volume",resourceName:node.ref})),node instanceof rds().CfnDBInstance&&(node.dbClusterIdentifier||this.resources.push(core_1().Stack.of(node).formatArn({service:"rds",resource:"db",arnFormat:core_1().ArnFormat.COLON_RESOURCE_NAME,resourceName:node.ref}))),node instanceof rds().CfnDBCluster&&this.resources.push(core_1().Stack.of(node).formatArn({service:"rds",resource:"cluster",arnFormat:core_1().ArnFormat.COLON_RESOURCE_NAME,resourceName:node.ref}))}}exports.BackupableResourcesCollector=BackupableResourcesCollector;

cdk/node_modules/aws-cdk-lib/aws-backup/lib/index.d.ts

@@ -0,0 +1,6 @@
+export * from './vault';
+export * from './plan';
+export * from './rule';
+export * from './selection';
+export * from './resource';
+export * from './backup.generated';

cdk/node_modules/aws-cdk-lib/aws-backup/lib/plan.d.ts

@@ -0,0 +1,114 @@
+import type { Construct } from 'constructs';
+import { BackupPlanRule } from './rule';
+import type { BackupSelectionOptions } from './selection';
+import { BackupSelection } from './selection';
+import type { IBackupVault } from './vault';
+import type { IResource } from '../../core';
+import { Resource } from '../../core';
+import type { BackupPlanReference, IBackupPlanRef, IBackupVaultRef } from '../../interfaces/generated/aws-backup-interfaces.generated';
+/**
+ * A backup plan
+ */
+export interface IBackupPlan extends IResource, IBackupPlanRef {
+    /**
+     * The identifier of the backup plan.
+     *
+     * @attribute
+     */
+    readonly backupPlanId: string;
+}
+/**
+ * Properties for a BackupPlan
+ */
+export interface BackupPlanProps {
+    /**
+     * The display name of the backup plan.
+     *
+     * @default - A CDK generated name
+     */
+    readonly backupPlanName?: string;
+    /**
+     * The backup vault where backups are stored
+     *
+     * @default - use the vault defined at the rule level. If not defined a new
+     * common vault for the plan will be created
+     */
+    readonly backupVault?: IBackupVaultRef;
+    /**
+     * Rules for the backup plan. Use `addRule()` to add rules after
+     * instantiation.
+     *
+     * @default - use `addRule()` to add rules
+     */
+    readonly backupPlanRules?: BackupPlanRule[];
+    /**
+     * Enable Windows VSS backup.
+     *
+     * @see https://docs.aws.amazon.com/aws-backup/latest/devguide/windows-backups.html
+     *
+     * @default false
+     */
+    readonly windowsVss?: boolean;
+}
+/**
+ * A backup plan
+ */
+export declare class BackupPlan extends Resource implements IBackupPlan {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Import an existing backup plan
+     */
+    static fromBackupPlanId(scope: Construct, id: string, backupPlanId: string): IBackupPlan;
+    /**
+     * Daily with 35 day retention
+     */
+    static daily35DayRetention(scope: Construct, id: string, backupVault?: IBackupVaultRef): BackupPlan;
+    /**
+     * Daily and monthly with 1 year retention
+     */
+    static dailyMonthly1YearRetention(scope: Construct, id: string, backupVault?: IBackupVaultRef): BackupPlan;
+    /**
+     * Daily, weekly and monthly with 5 year retention
+     */
+    static dailyWeeklyMonthly5YearRetention(scope: Construct, id: string, backupVault?: IBackupVaultRef): BackupPlan;
+    /**
+     * Daily, weekly and monthly with 7 year retention
+     */
+    static dailyWeeklyMonthly7YearRetention(scope: Construct, id: string, backupVault?: IBackupVaultRef): BackupPlan;
+    readonly backupPlanId: string;
+    /**
+     * The ARN of the backup plan
+     *
+     * @attribute
+     */
+    readonly backupPlanArn: string;
+    /**
+     * Version Id
+     *
+     * @attribute
+     */
+    readonly versionId: string;
+    get backupPlanRef(): BackupPlanReference;
+    private readonly rules;
+    private _backupVault?;
+    constructor(scope: Construct, id: string, props?: BackupPlanProps);
+    private advancedBackupSettings;
+    /**
+     * Adds a rule to a plan
+     *
+     * @param rule the rule to add
+     */
+    addRule(rule: BackupPlanRule): void;
+    private planCopyActions;
+    /**
+     * The backup vault where backups are stored if not defined at
+     * the rule level
+     */
+    get backupVault(): IBackupVault;
+    /**
+     * Adds a selection to this plan
+     */
+    addSelection(id: string, options: BackupSelectionOptions): BackupSelection;
+    private validatePlan;
+}

cdk/node_modules/aws-cdk-lib/aws-backup/lib/private/ref-utils.d.ts

@@ -0,0 +1,7 @@
+import type { IBackupVaultRef } from '../../../interfaces/generated/aws-backup-interfaces.generated';
+import type { IBackupVault } from '../vault';
+/**
+ * Convert an IBackupVaultRef to IBackupVault, throwing an error if the instance
+ * doesn't implement the full IBackupVault interface.
+ */
+export declare function toIBackupVault(vault: IBackupVaultRef): IBackupVault;

cdk/node_modules/aws-cdk-lib/aws-backup/lib/private/ref-utils.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.toIBackupVault=toIBackupVault;var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};function toIBackupVault(vault){if(!("backupVaultName"in vault)||!("backupVaultArn"in vault)||!("grant"in vault))throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`VaultInstanceShouldImplement`,`'vault' instance should implement IBackupVault, but doesn't: ${vault.constructor.name}`);return vault}

cdk/node_modules/aws-cdk-lib/aws-backup/lib/resource.d.ts

@@ -0,0 +1,101 @@
+import type { Construct } from 'constructs';
+import type * as dynamodb from '../../aws-dynamodb';
+import type * as ec2 from '../../aws-ec2';
+import type { aws_rds } from '../../interfaces';
+import type { IFileSystemRef } from '../../interfaces/generated/aws-efs-interfaces.generated';
+/**
+ * An operation that is applied to a key-value pair
+ */
+export declare enum TagOperation {
+    /**
+     * StringEquals
+     */
+    STRING_EQUALS = "STRINGEQUALS",
+    /**
+     * Dummy member
+     */
+    DUMMY = "dummy"
+}
+/**
+ * A tag condition
+ */
+export interface TagCondition {
+    /**
+     * The key in a key-value pair.
+     *
+     * For example, in `"ec2:ResourceTag/Department": "accounting"`,
+     * `ec2:ResourceTag/Department` is the key.
+     */
+    readonly key: string;
+    /**
+     * An operation that is applied to a key-value pair used to filter
+     * resources in a selection.
+     *
+     * @default STRING_EQUALS
+     */
+    readonly operation?: TagOperation;
+    /**
+     * The value in a key-value pair.
+     *
+     * For example, in `"ec2:ResourceTag/Department": "accounting"`,
+     * `accounting` is the value.
+     */
+    readonly value: string;
+}
+/**
+ * A resource to backup
+ */
+export declare class BackupResource {
+    /**
+     * Adds all supported resources in a construct
+     *
+     * @param construct The construct containing resources to backup
+     */
+    static fromConstruct(construct: Construct): BackupResource;
+    /**
+     * A DynamoDB table
+     */
+    static fromDynamoDbTable(table: dynamodb.ITableRef): BackupResource;
+    /**
+     * An EC2 instance
+     */
+    static fromEc2Instance(instance: ec2.IInstanceRef): BackupResource;
+    /**
+     * An EFS file system
+     */
+    static fromEfsFileSystem(fileSystem: IFileSystemRef): BackupResource;
+    /**
+     * A RDS database instance
+     */
+    static fromRdsDatabaseInstance(instance: aws_rds.IDBInstanceRef): BackupResource;
+    /**
+     * A RDS database cluter
+     */
+    static fromRdsDatabaseCluster(cluster: aws_rds.IDBClusterRef): BackupResource;
+    /**
+     * An Aurora database instance
+     */
+    static fromRdsServerlessCluster(cluster: aws_rds.IDBClusterRef): BackupResource;
+    /**
+     * A list of ARNs or match patterns such as
+     * `arn:aws:ec2:us-east-1:123456789012:volume/*`
+     */
+    static fromArn(arn: string): BackupResource;
+    /**
+     * A tag condition
+     */
+    static fromTag(key: string, value: string, operation?: TagOperation): BackupResource;
+    /**
+     * A resource
+     */
+    readonly resource?: string;
+    /**
+     * A condition on a tag
+     */
+    readonly tagCondition?: TagCondition;
+    /**
+     * A construct
+     */
+    readonly construct?: Construct;
+    constructor(resource?: string, tagCondition?: TagCondition, construct?: Construct);
+}

cdk/node_modules/aws-cdk-lib/aws-backup/lib/resource.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.BackupResource=exports.TagOperation=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},TagOperation;(function(TagOperation2){TagOperation2.STRING_EQUALS="STRINGEQUALS",TagOperation2.DUMMY="dummy"})(TagOperation||(exports.TagOperation=TagOperation={}));class BackupResource{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_backup.BackupResource",version:"2.252.0"};static fromConstruct(construct){return new BackupResource(void 0,void 0,construct)}static fromDynamoDbTable(table){try{jsiiDeprecationWarnings().aws_cdk_lib_interfaces_aws_dynamodb_ITableRef(table)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromDynamoDbTable),error}return BackupResource.fromArn(table.tableRef.tableArn)}static fromEc2Instance(instance){try{jsiiDeprecationWarnings().aws_cdk_lib_interfaces_aws_ec2_IInstanceRef(instance)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromEc2Instance),error}return BackupResource.fromArn(core_1().Stack.of(instance).formatArn({service:"ec2",resource:"instance",resourceName:instance.instanceRef.instanceId}))}static fromEfsFileSystem(fileSystem){try{jsiiDeprecationWarnings().aws_cdk_lib_interfaces_aws_efs_IFileSystemRef(fileSystem)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromEfsFileSystem),error}return BackupResource.fromArn(core_1().Stack.of(fileSystem).formatArn({service:"elasticfilesystem",resource:"file-system",resourceName:fileSystem.fileSystemRef.fileSystemId}))}static fromRdsDatabaseInstance(instance){try{jsiiDeprecationWarnings().aws_cdk_lib_interfaces_aws_rds_IDBInstanceRef(instance)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromRdsDatabaseInstance),error}return BackupResource.fromArn(instance.dbInstanceRef.dbInstanceArn)}static fromRdsDatabaseCluster(cluster){try{jsiiDeprecationWarnings().aws_cdk_lib_interfaces_aws_rds_IDBClusterRef(cluster)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromRdsDatabaseCluster),error}const stack=core_1().Stack.of(cluster);return BackupResource.fromArn(`arn:${stack.partition}:rds:${stack.region}:${stack.account}:cluster:${cluster.dbClusterRef.dbClusterIdentifier}`)}static fromRdsServerlessCluster(cluster){try{jsiiDeprecationWarnings().aws_cdk_lib_interfaces_aws_rds_IDBClusterRef(cluster)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromRdsServerlessCluster),error}return BackupResource.fromArn(cluster.dbClusterRef.dbClusterArn)}static fromArn(arn){return new BackupResource(arn)}static fromTag(key,value,operation){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_backup_TagOperation(operation)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromTag),error}return new BackupResource(void 0,{key,value,operation})}resource;tagCondition;construct;constructor(resource,tagCondition,construct){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_backup_TagCondition(tagCondition)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,BackupResource),error}this.resource=resource,this.tagCondition=tagCondition,this.construct=construct}}exports.BackupResource=BackupResource;

cdk/node_modules/aws-cdk-lib/aws-backup/lib/rule.d.ts

@@ -0,0 +1,139 @@
+import * as events from '../../aws-events';
+import type { TimeZone } from '../../core';
+import { Duration } from '../../core';
+import type { IBackupVaultRef } from '../../interfaces/generated/aws-backup-interfaces.generated';
+/**
+ * Properties for a BackupPlanRule
+ */
+export interface BackupPlanRuleProps {
+    /**
+     * The duration after a backup job is successfully started before it must be
+     * completed or it is canceled by AWS Backup.
+     *
+     * @default - 7 days
+     */
+    readonly completionWindow?: Duration;
+    /**
+     * Specifies the duration after creation that a recovery point is deleted.
+     * Must be greater than `moveToColdStorageAfter`.
+     *
+     * @default - recovery point is never deleted
+     */
+    readonly deleteAfter?: Duration;
+    /**
+     * Specifies the duration after creation that a recovery point is moved to cold
+     * storage.
+     *
+     * @default - recovery point is never moved to cold storage
+     */
+    readonly moveToColdStorageAfter?: Duration;
+    /**
+     * A display name for the backup rule.
+     *
+     * @default - a CDK generated name
+     */
+    readonly ruleName?: string;
+    /**
+     * A CRON expression specifying when AWS Backup initiates a backup job.
+     *
+     * @default - no schedule
+     */
+    readonly scheduleExpression?: events.Schedule;
+    /**
+     * The timezone in which the schedule expression is set.
+     *
+     * @default - UTC
+     */
+    readonly scheduleExpressionTimezone?: TimeZone;
+    /**
+     * The duration after a backup is scheduled before a job is canceled if it doesn't start successfully.
+     *
+     * @default - 8 hours
+     */
+    readonly startWindow?: Duration;
+    /**
+     * The backup vault where backups are
+     *
+     * @default - use the vault defined at the plan level. If not defined a new
+     * common vault for the plan will be created
+     */
+    readonly backupVault?: IBackupVaultRef;
+    /**
+     * Enables continuous backup and point-in-time restores (PITR).
+     *
+     * Property `deleteAfter` defines the retention period for the backup. It is mandatory if PITR is enabled.
+     * If no value is specified, the retention period is set to 35 days which is the maximum retention period supported by PITR.
+     *
+     * Property `moveToColdStorageAfter` must not be specified because PITR does not support this option.
+     *
+     * @default false
+     */
+    readonly enableContinuousBackup?: boolean;
+    /**
+     * Copy operations to perform on recovery points created by this rule
+     *
+     * @default - no copy actions
+     */
+    readonly copyActions?: BackupPlanCopyActionProps[];
+    /**
+     * To help organize your resources, you can assign your own metadata to the resources that you create. Each tag is a key-value pair.
+     *
+     * @default - no recovery point tags.
+     */
+    readonly recoveryPointTags?: {
+        [key: string]: string;
+    };
+}
+/**
+ * Properties for a BackupPlanCopyAction
+ */
+export interface BackupPlanCopyActionProps {
+    /**
+     * Destination Vault for recovery points to be copied into
+     */
+    readonly destinationBackupVault: IBackupVaultRef;
+    /**
+     * Specifies the duration after creation that a copied recovery point is deleted from the destination vault.
+     * Must be at least 90 days greater than `moveToColdStorageAfter`, if specified.
+     *
+     * @default - recovery point is never deleted
+     */
+    readonly deleteAfter?: Duration;
+    /**
+     * Specifies the duration after creation that a copied recovery point is moved to cold storage.
+     *
+     * @default - recovery point is never moved to cold storage
+     */
+    readonly moveToColdStorageAfter?: Duration;
+}
+/**
+ * A backup plan rule
+ */
+export declare class BackupPlanRule {
+    /**
+     * Daily with 35 days retention
+     */
+    static daily(backupVault?: IBackupVaultRef): BackupPlanRule;
+    /**
+     * Weekly with 3 months retention
+     */
+    static weekly(backupVault?: IBackupVaultRef): BackupPlanRule;
+    /**
+     * Monthly 1 year retention, move to cold storage after 1 month
+     */
+    static monthly1Year(backupVault?: IBackupVaultRef): BackupPlanRule;
+    /**
+     * Monthly 5 year retention, move to cold storage after 3 months
+     */
+    static monthly5Year(backupVault?: IBackupVaultRef): BackupPlanRule;
+    /**
+     * Monthly 7 year retention, move to cold storage after 3 months
+     */
+    static monthly7Year(backupVault?: IBackupVaultRef): BackupPlanRule;
+    /**
+     * Properties of BackupPlanRule
+     */
+    readonly props: BackupPlanRuleProps;
+    /** @param props Rule properties */
+    constructor(props: BackupPlanRuleProps);
+}

cdk/node_modules/aws-cdk-lib/aws-backup/lib/selection.d.ts

@@ -0,0 +1,84 @@
+import type { Construct } from 'constructs';
+import type { BackupResource } from './resource';
+import * as iam from '../../aws-iam';
+import { Resource } from '../../core';
+import type { IBackupPlanRef } from '../../interfaces/generated/aws-backup-interfaces.generated';
+/**
+ * Options for a BackupSelection
+ */
+export interface BackupSelectionOptions {
+    /**
+     * The resources to backup.
+     * Use the helper static methods defined on `BackupResource`.
+     */
+    readonly resources: BackupResource[];
+    /**
+     * The name for this selection
+     *
+     * @default - a CDK generated name
+     */
+    readonly backupSelectionName?: string;
+    /**
+     * The role that AWS Backup uses to authenticate when backuping or restoring
+     * the resources. The `AWSBackupServiceRolePolicyForBackup` managed policy
+     * will be attached to this role unless `disableDefaultBackupPolicy`
+     * is set to `true`.
+     *
+     * @default - a new role will be created
+     */
+    readonly role?: iam.IRole;
+    /**
+     * Whether to disable automatically assigning default backup permissions to the role
+     * that AWS Backup uses.
+     * If `false`, the `AWSBackupServiceRolePolicyForBackup` managed policy will be
+     * attached to the role.
+     *
+     * @default false
+     */
+    readonly disableDefaultBackupPolicy?: boolean;
+    /**
+     * Whether to automatically give restores permissions to the role that AWS
+     * Backup uses. If `true`, the `AWSBackupServiceRolePolicyForRestores` managed
+     * policy will be attached to the role.
+     *
+     * @default false
+     */
+    readonly allowRestores?: boolean;
+}
+/**
+ * Properties for a BackupSelection
+ */
+export interface BackupSelectionProps extends BackupSelectionOptions {
+    /**
+     * The backup plan for this selection
+     */
+    readonly backupPlan: IBackupPlanRef;
+}
+/**
+ * A backup selection
+ */
+export declare class BackupSelection extends Resource implements iam.IGrantable {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * The identifier of the backup plan.
+     *
+     * @attribute
+     */
+    readonly backupPlanId: string;
+    /**
+     * The identifier of the backup selection.
+     *
+     * @attribute
+     */
+    readonly selectionId: string;
+    /**
+     * The principal to grant permissions to
+     */
+    readonly grantPrincipal: iam.IPrincipal;
+    private listOfTags;
+    private resources;
+    private readonly backupableResourcesCollector;
+    constructor(scope: Construct, id: string, props: BackupSelectionProps);
+    private addResource;
+}

cdk/node_modules/aws-cdk-lib/aws-backup/lib/vault.d.ts

@@ -0,0 +1,228 @@
+import type { Construct } from 'constructs';
+import * as iam from '../../aws-iam';
+import type * as kms from '../../aws-kms';
+import type * as sns from '../../aws-sns';
+import type { Duration, IResource, RemovalPolicy } from '../../core';
+import { Resource } from '../../core';
+import type { BackupVaultReference, IBackupVaultRef } from '../../interfaces/generated/aws-backup-interfaces.generated';
+/**
+ * A backup vault
+ */
+export interface IBackupVault extends IResource, IBackupVaultRef {
+    /**
+     * The name of a logical container where backups are stored.
+     *
+     * @attribute
+     */
+    readonly backupVaultName: string;
+    /**
+     * The ARN of the backup vault.
+     *
+     * @attribute
+     */
+    readonly backupVaultArn: string;
+    /**
+     * Grant the actions defined in actions to the given grantee
+     * on this backup vault.
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+}
+/**
+ * Properties for a BackupVault
+ */
+export interface BackupVaultProps {
+    /**
+     * The name of a logical container where backups are stored. Backup vaults
+     * are identified by names that are unique to the account used to create
+     * them and the AWS Region where they are created.
+     *
+     * @default - A CDK generated name
+     */
+    readonly backupVaultName?: string;
+    /**
+     * A resource-based policy that is used to manage access permissions on the
+     * backup vault.
+     *
+     * @default - access is not restricted
+     */
+    readonly accessPolicy?: iam.PolicyDocument;
+    /**
+     * The server-side encryption key to use to protect your backups.
+     *
+     * @default - an Amazon managed KMS key
+     */
+    readonly encryptionKey?: kms.IKeyRef;
+    /**
+     * A SNS topic to send vault events to.
+     *
+     * @see https://docs.aws.amazon.com/aws-backup/latest/devguide/sns-notifications.html
+     *
+     * @default - no notifications
+     */
+    readonly notificationTopic?: sns.ITopic;
+    /**
+     * The vault events to send.
+     *
+     * @see https://docs.aws.amazon.com/aws-backup/latest/devguide/sns-notifications.html
+     *
+     * @default - all vault events if `notificationTopic` is defined
+     */
+    readonly notificationEvents?: BackupVaultEvents[];
+    /**
+     * The removal policy to apply to the vault. Note that removing a vault
+     * that contains recovery points will fail.
+     *
+     * @default RemovalPolicy.RETAIN
+     */
+    readonly removalPolicy?: RemovalPolicy;
+    /**
+     * Whether to add statements to the vault access policy that prevents anyone
+     * from deleting a recovery point.
+     *
+     * @default false
+     */
+    readonly blockRecoveryPointDeletion?: boolean;
+    /**
+     * Configuration for AWS Backup Vault Lock
+     *
+     * @see https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html
+     *
+     * @default - AWS Backup Vault Lock is disabled
+     */
+    readonly lockConfiguration?: LockConfiguration;
+}
+/**
+ * Backup vault events. Some events are no longer supported and will not return
+ * statuses or notifications.
+ *
+ * @see https://docs.aws.amazon.com/aws-backup/latest/devguide/API_PutBackupVaultNotifications.html#API_PutBackupVaultNotifications_RequestBody
+ */
+export declare enum BackupVaultEvents {
+    /** BACKUP_JOB_STARTED */
+    BACKUP_JOB_STARTED = "BACKUP_JOB_STARTED",
+    /** BACKUP_JOB_COMPLETED */
+    BACKUP_JOB_COMPLETED = "BACKUP_JOB_COMPLETED",
+    /** BACKUP_JOB_SUCCESSFUL */
+    BACKUP_JOB_SUCCESSFUL = "BACKUP_JOB_SUCCESSFUL",
+    /** BACKUP_JOB_FAILED */
+    BACKUP_JOB_FAILED = "BACKUP_JOB_FAILED",
+    /** BACKUP_JOB_EXPIRED */
+    BACKUP_JOB_EXPIRED = "BACKUP_JOB_EXPIRED",
+    /** RESTORE_JOB_STARTED */
+    RESTORE_JOB_STARTED = "RESTORE_JOB_STARTED",
+    /** RESTORE_JOB_COMPLETED */
+    RESTORE_JOB_COMPLETED = "RESTORE_JOB_COMPLETED",
+    /** RESTORE_JOB_SUCCESSFUL */
+    RESTORE_JOB_SUCCESSFUL = "RESTORE_JOB_SUCCESSFUL",
+    /** RESTORE_JOB_FAILED */
+    RESTORE_JOB_FAILED = "RESTORE_JOB_FAILED",
+    /** COPY_JOB_STARTED */
+    COPY_JOB_STARTED = "COPY_JOB_STARTED",
+    /** COPY_JOB_SUCCESSFUL */
+    COPY_JOB_SUCCESSFUL = "COPY_JOB_SUCCESSFUL",
+    /** COPY_JOB_FAILED */
+    COPY_JOB_FAILED = "COPY_JOB_FAILED",
+    /** RECOVERY_POINT_MODIFIED */
+    RECOVERY_POINT_MODIFIED = "RECOVERY_POINT_MODIFIED",
+    /** BACKUP_PLAN_CREATED */
+    BACKUP_PLAN_CREATED = "BACKUP_PLAN_CREATED",
+    /** BACKUP_PLAN_MODIFIED */
+    BACKUP_PLAN_MODIFIED = "BACKUP_PLAN_MODIFIED",
+    /** S3_BACKUP_OBJECT_FAILED */
+    S3_BACKUP_OBJECT_FAILED = "S3_BACKUP_OBJECT_FAILED",
+    /** BACKUP_PLAN_MODIFIED */
+    S3_RESTORE_OBJECT_FAILED = "S3_RESTORE_OBJECT_FAILED"
+}
+/**
+ * Configuration for AWS Backup Vault Lock
+ *
+ * @see https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html
+ */
+export interface LockConfiguration {
+    /**
+     * The minimum retention period that the vault retains its recovery points.
+     *
+     * If this parameter is specified, any backup or copy job to the vault must
+     * have a lifecycle policy with a retention period equal to or longer than
+     * the minimum retention period. If the job's retention period is shorter than
+     * that minimum retention period, then the vault fails that backup or copy job,
+     * and you should either modify your lifecycle settings or use a different
+     * vault. Recovery points already saved in the vault prior to Vault Lock are
+     * not affected.
+     */
+    readonly minRetention: Duration;
+    /**
+     * The maximum retention period that the vault retains its recovery points.
+     *
+     * If this parameter is specified, any backup or copy job to the vault must
+     * have a lifecycle policy with a retention period equal to or shorter than
+     * the maximum retention period. If the job's retention period is longer than
+     * that maximum retention period, then the vault fails the backup or copy job,
+     * and you should either modify your lifecycle settings or use a different
+     * vault. Recovery points already saved in the vault prior to Vault Lock are
+     * not affected.
+     *
+     * @default - Vault Lock does not enforce a maximum retention period
+     */
+    readonly maxRetention?: Duration;
+    /**
+     * The duration before the lock date.
+     *
+     * AWS Backup enforces a 72-hour cooling-off period before Vault Lock takes
+     * effect and becomes immutable.
+     *
+     * Before the lock date, you can delete Vault Lock from the vault or change
+     * the Vault Lock configuration. On and after the lock date, the Vault Lock
+     * becomes immutable and cannot be changed or deleted.
+     *
+     * @default - Vault Lock can be deleted or changed at any time
+     */
+    readonly changeableFor?: Duration;
+}
+declare abstract class BackupVaultBase extends Resource implements IBackupVault {
+    abstract readonly backupVaultName: string;
+    abstract readonly backupVaultArn: string;
+    get backupVaultRef(): BackupVaultReference;
+    /**
+     * Grant the actions defined in actions to the given grantee
+     * on this Backup Vault resource.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee Principal to grant right to
+     * @param actions The actions to grant
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+}
+/**
+ * A backup vault
+ */
+export declare class BackupVault extends BackupVaultBase {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Import an existing backup vault by name
+     */
+    static fromBackupVaultName(scope: Construct, id: string, backupVaultName: string): IBackupVault;
+    /**
+     * Import an existing backup vault by arn
+     */
+    static fromBackupVaultArn(scope: Construct, id: string, backupVaultArn: string): IBackupVault;
+    readonly backupVaultName: string;
+    readonly backupVaultArn: string;
+    private readonly accessPolicy;
+    constructor(scope: Construct, id: string, props?: BackupVaultProps);
+    /**
+     * Adds a statement to the vault access policy
+     */
+    addToAccessPolicy(statement: iam.PolicyStatement): void;
+    /**
+     * Adds a statement to the vault access policy that prevents anyone
+     * from deleting a recovery point.
+     */
+    blockRecoveryPointDeletion(): void;
+    private uniqueVaultName;
+}
+export {};